NbtStat

Nbtstat (standing for NetBios Over TCP/IP Statistics) is a CLT that displays the cached NetBios name table. We can use it to display NetBios adapter status, the name-to-IP address mappings, names that have been registered locally on a system by NetBios applications, and even displays names resolved by broadcasts and by querying WINS servers. For more information see: http://technet.microsoft.com/en-us/library/cc940106.aspx.
How it works: To display the NetBios name cache, we can use the command "nbtstat -c".

Personal Remarks: For all of the labs that we completed, there were no NetBios names in the cache. I can see where this could be benefical if an attacker had accessed a computer and that registered in the NetBios and they no longer had an active connection. Of course, I never ran across this, so I can't really speak to the validity of this.
In addition to the -c swtich, there is the -A switch that lets you pass in a single ip address to check. It looks like the could be benefical. The -a swtich shows the status of the NetBios adapter.

FPort

FPort (made by McAffe) is another CLT that can display open ports with executables linked to them. It can easily display programs that opened ports and the protocol that it is using. The lastest version is v2.0 and can be downloaded here: http://www.mcafee.com/us/downloads/free-tools/fport.aspx.
How it works: using the command line, just typing "FPort" will run the program to display all the ports with excutables linked to them.

Personal remarks: This tool can be difficult to find, but easy to use. The link above is the correct link to use. I made the mistake of downloading from some where third party site. Pretty sure it was virus infected. Oh well, everyone can use a bit more spyware.
The output of FPort displays all the open ports and what applications are linked to them. This is handy to see if there is a certain program that is leaking data. Using this tool with wireshark is helpful if there is a open port found with an application linked to it.

NetStat

NetStat is a CLT (command line tool) that displays a network connections, routing tables, and network interfaces. It is built into both Unix/Unix-Like, and Windows machines.
How it works: using "netstat -an" will display all the active connections on a machine.
"Netstat -rn" can be used to display the routing table.

Personal remarks: The information given from this tool can be extremely helpful, especially in network analysis for active connections. On almost every lab used, "netstat -an" was used. Once a connection is seen that is foreign, Wireshark can be used to capture traffic being sent to that address or from that address.

NetStat example output
http://indonetworksecurity.com

NetCat

       Netcat is a TelNet client that can be used to send information from one machine to another. It's commonly called the 'swiss army knife' due to it's functionality and common use with forensic investigators.

How it works: a listener needs to be established on the machine that you wish to pass data to. This is accomplished with the command "netcat -v -l -p 2222 > [filename].txt". The -v puts netcat into verbose mode, which will display status messages. The -l is the listening switch. Finally, -p is to secifiy the port to listen on. The ending portion after the greater-than sign is the output file.
To then send a command from a machine to the listener, you'll run: "[some command] | netcat [ip of listener] [port number]". The [ip of listener] is the ip address of where the netcat listener is.
Overall, netcat is a easy and quick way to send information from one machine to another.

Where to download: The version of netcat that I enjoy and have found to work the best is the beta version from nmap. Download can be found here: http://nmap.org/ncat/.

Personal remarks: Netcat is a fairly easy to use tool that can transfer files and information between computers quickly. That is, if you get it set up right. Initally using netcat, it took a number of failed attempts to finally realize the format of commands. Then even more failed attempts to realize that the firewall was blocking the port we were sending info through. After those user 'blunders' the tool is extremely easy to use and pretty efficent.

Wireshark

According to the Wireshark website, Wireshark is the "world's foremost network protocol analyzer". It allows a user to capture and analyze network traffic. I have no facts to support this, but would say that it's one of the main programs that a security or forensics user would use.

One of the nice things about Wireshark is that it's free and open-source. Generally, open-source projects, when they gather steam, are done pretty well and kept up to date (look at Linux). Plus it has quite a bit of functionality of looking at various protocols and streams.